6 ms·

I recently gave Ghostty a chance and have since switched over from iTerm2 completely. It's very familiar and polished.

hmeh 2y ago
Same. So far so good.
akerl_ 2y ago
Probably worth noting that Ghostty was very recently vulnerable to an old/familiar class of terminal vuln that bit a bunch of older terminal applications a while back: https://dgl.cx/2024/12/ghostty-terminal-title https://dgl.cx/2024/12/ghostty-terminal-title So moving to a newer / less "bloated" terminal may also just wind the clock back and cause you to encounter a similar sequence of vulns again, like some kind of unfortunate real-world "New Game Plus".
- jolux 2y ago
  Having a vuln that many other terminal emulators have had is pretty different from the string of unique and extremely bad vulns that iTerm has had over the years. It’s possible that we’ll see similar from Ghostty, but it’s a much newer and I believe smaller codebase, so I’m willing to give it a second chance.
  - akerl_ 2y ago
    I've been using iTerm daily for something like a decade at this point and I'm struggling to think of any examples of this string of extremely bad vulns. There's this one, which is specific to SSH integration. There was CVE-2024-38396, which is the window title escape sequences I was talking about above. What others am I missing?
    - jolux 2y ago
      How about making DNS requests for everything you hover over to determine if it’s a URL? https://www.bleepingcomputer.com/news/security/iterm2-leaks-everything-you-hover-in-your-terminal-via-dns-requests/ https://www.bleepingcomputer.com/news/security/iterm2-leaks-...
      - ahefner 2y ago
        [flagged]
        ahefner 2y ago
        [flagged]
        saagarjha 2y ago
        No, it's just that you're exceptionally rude.
        ahefner 2y ago
        Probably true, but it still stings that this dubious piece of software (speaking as a former iTerm2 user still holding a grudge) had been spraying my passwords and random terminal activity all over the internet in the form of unencrypted DNS requests for who knows how long, deliberately, due to mindless opt-out featuritis on the part of the developer. In my mind this is one of the clearest violations of privacy and information security I've been directly subjected to, because the developer had some gee-whiz-neato idea of highlighting URLs in a terminal and making them clickable. It pains me to think people are still exposing themselves to this class of risk because of whatever iTerm2's latest and greatest idea is.
        saagarjha 2y ago
        I think it's very reasonable to point at the development model and go, "I think this is bad and specifically the cause for security vulnerabilities". If you want to make that your position (I am sure it is already, and I don't think it is particularly controversial) that is completely fine. But there's a difference between holding that and your actual comment. Like, this was 100% unintentional, and people literally introduce malicious or undesirable features in their software all the time. Maybe we should save the tarring and feathering for that, and come up with a more measured take for stuff like this?
      - 2y ago
  - boomlinde 2y ago
    I can only find three CVEs prior to this. It's only one of those that I would qualify as "extremely bad" (the DNS query leak you mention below). The others are the window title bug GP mentions and the undocumented maintenance of a plain text search history file.
- samatman 2y ago
  Ghostty has also been out for what, a week? So this is the open season / shakedown, when security researchers get to try out all the old favorites and see what got missed. I don't think there are larger lessons to draw from that occurrence. A reputation for security has to be earned, and Ghostty hasn't been around long enough for that. From my vantage point it's on track, but only time will tell.
  - akerl_ 2y ago
    I'm not trying to knock either Ghostty in particular or new software in general. But the kind of "open season" phase you're referring to is basically the same point I'm making: new software still has to go through the phase where they work through their security model, have it probed by researchers, and earn their reputation.
woadwarrior01 2y ago
I did the same. Although, Ghostty doesn't seem to have support for Find (⌘-F), yet. Also, had some minor hiccups with it and tmux on remote hosts.
- NovaX 2y ago
  I've resorted to using Cmd-Shift-J (scrollback buffer) and grepping that, but its flaky about whether it will honor the command and emit a history file.
dave4420 2y ago
I tried Ghostty earlier in the week, but couldn’t get it set up to look the same as iterm2 (the colours are off and text looks different somehow with the same typeface at the same size). Which is just cosmetic but makes it feel wrong viscerally. I’ll give it another go at the weekend.
- crabique 2y ago
  Somehow this is the first time I see anyone else bring this up, but the fonts are absolutely displayed with wrong kerning on my mac, for my font (at 12pt) I was able to make it look the same as iTerm2 with adjust-cell-{width,height} both set to -5%.
  - Hamuko 2y ago
    I had an issue where Ghostty failed to render the text "th", so I think Ghostty just generally has a lot of font issues. Gave up trying to use it within minutes.
- samatman 2y ago
  Ghostty supports iTerm themes, so you should be able to transfer your preferred look-and-feel directly. I just picked one I liked, so I'm not familiar with the process, but it can be done.
  - d4rkp4ttern 2y ago
    Could you please point to the docs about how to transfer iTerm2 themes to Ghostty? I couldn't find it.
    - samatman 2y ago
      It looks like the process is more manual than I thought, sorry. There's something which imports themes from the iTerm2 color schemes website weekly, but from what I can find that isn't a feature which ships with Ghostty itself. Here's the relevant docs page, which I hope explains why I mistakenly thought that transferring a theme directly from iTerm to Ghostty was possible. You could upload your theme to the website they're being sourced from, and wait a week. But that's clearly not the same thing. https://ghostty.org/docs/features/theme https://ghostty.org/docs/features/theme
crabique 2y ago
Unfortunately, it's nowhere near close feature-wise just yet: proper quake mode, search, prompt navigation, line timestamps, tab output indicators, forced keyboard locales, customizable toolbar with user-defined variables/indicators, are all too useful to give up iTerm2 for anything.
- lilyball 2y ago
  What's not proper about Ghostty's quake mode?
  - Aeolos 2y ago
    It does not support tabs, for one.
- __float 2y ago
  What is "proper Quake mode"? Have you tried https://ghostty.org/docs/config/keybind/reference#toggle_quick_terminal https://ghostty.org/docs/config/keybind/reference#toggle_qui...? (I don't have the habit to use this feature, but I'd like to!) The others do sound useful too -- I personally hit a lot of spurious "tab output indicator" notifications in iTerm2, but if it _did_ work I could see how giving it up would be painful.
  - Geezus_42 2y ago
    I got the toggle working, but couldn't get background transparency.
  - crabique 2y ago
    Proper quake mode is just one shortcut to show/hide the entire terminal window, otherwise the app is completely hidden from the app switcher and the dock. This also involves handling macOS keyboard-to-app layout mapper not reacting to this event as the window loses its first-class citizen status in this mode.
- cosmic_cheese 2y ago
  I tried iTerm’s quake mode after the Visor haxie for Terminal.app was shuttered, but unfortunately was left disappointed. Its behavior is kinda glitchy and inconsistent in comparison, which was surprising because one would expect a native feature to be better than one hacked in by a third party, but that was not the case here.
rcpt 2y ago
I tried Ctrl+r while she'd and it didn't work. Otherwise ghosty looked great
segasaturn 2y ago
I tried Ghostty but the configuration file seems to be flakey. For example I wasn't able to turn off the cursor blinking in it (huge distraction for me) despite there being a configuration flag for it, it just wouldn't take it.
- auscompgeek 2y ago
  There's a known issue where the shell integration doesn't respect that setting when it sets the cursor shape. https://github.com/ghostty-org/ghostty/discussions/2812 https://github.com/ghostty-org/ghostty/discussions/2812
- dsego 2y ago
  Have you tried shell-integration-features = no-cursor ?
kergonath 2y ago
I am using both at the moment, but iTerm has many, many features missing in ghostty. Most of them are not huge, but overall that’s a lot of paper cuts. Ultimately I wish both will stick around. Both have good ideas and I’d like them to keep evolving.
tylersmith 2y ago
Ghostty hasn't had to put out a critical update since before 1.0 launched.
throwaway314155 2y ago
> It's very familiar... It is? Because as far as I can tell it is deliberately quite different from iTerm2. No GUI for preferences, for instance. Not knocking it, it's a great terminal. I wouldn't describe it as "familiar" though, unless you're switching from, say, WezTerm or Alacritty.
FreePalestine1 2y ago
Does Ghostty support natural text editing like iTerm2 does?
dsego 2y ago
I also switched over to Ghostty, but now can't do Cmd+F to search for strings, I think it's on the roadmap though. Also, there are no scroll bars on the Mac version, which I guess is not that important for a terminal.

hmeh 2y ago

Same. So far so good.

Probably worth noting that Ghostty was very recently vulnerable to an old/familiar class of terminal vuln that bit a bunch of older terminal applications a while back: https://dgl.cx/2024/12/ghostty-terminal-title https://dgl.cx/2024/12/ghostty-terminal-title So moving to a newer / less "bloated" terminal may also just wind the clock back and cause you to encounter a similar sequence of vulns again, like some kind of unfortunate real-world "New Game Plus".

jolux 2y ago
Having a vuln that many other terminal emulators have had is pretty different from the string of unique and extremely bad vulns that iTerm has had over the years. It’s possible that we’ll see similar from Ghostty, but it’s a much newer and I believe smaller codebase, so I’m willing to give it a second chance.
- akerl_ 2y ago
  I've been using iTerm daily for something like a decade at this point and I'm struggling to think of any examples of this string of extremely bad vulns. There's this one, which is specific to SSH integration. There was CVE-2024-38396, which is the window title escape sequences I was talking about above. What others am I missing?
  - jolux 2y ago
    How about making DNS requests for everything you hover over to determine if it’s a URL? https://www.bleepingcomputer.com/news/security/iterm2-leaks-everything-you-hover-in-your-terminal-via-dns-requests/ https://www.bleepingcomputer.com/news/security/iterm2-leaks-...
    - ahefner 2y ago
      [flagged]
      - ahefner 2y ago
        [flagged]
        saagarjha 2y ago
        No, it's just that you're exceptionally rude.
        ahefner 2y ago
        Probably true, but it still stings that this dubious piece of software (speaking as a former iTerm2 user still holding a grudge) had been spraying my passwords and random terminal activity all over the internet in the form of unencrypted DNS requests for who knows how long, deliberately, due to mindless opt-out featuritis on the part of the developer. In my mind this is one of the clearest violations of privacy and information security I've been directly subjected to, because the developer had some gee-whiz-neato idea of highlighting URLs in a terminal and making them clickable. It pains me to think people are still exposing themselves to this class of risk because of whatever iTerm2's latest and greatest idea is.
        saagarjha 2y ago
        I think it's very reasonable to point at the development model and go, "I think this is bad and specifically the cause for security vulnerabilities". If you want to make that your position (I am sure it is already, and I don't think it is particularly controversial) that is completely fine. But there's a difference between holding that and your actual comment. Like, this was 100% unintentional, and people literally introduce malicious or undesirable features in their software all the time. Maybe we should save the tarring and feathering for that, and come up with a more measured take for stuff like this?
    - 2y ago
- boomlinde 2y ago
  I can only find three CVEs prior to this. It's only one of those that I would qualify as "extremely bad" (the DNS query leak you mention below). The others are the window title bug GP mentions and the undocumented maintenance of a plain text search history file.
samatman 2y ago
Ghostty has also been out for what, a week? So this is the open season / shakedown, when security researchers get to try out all the old favorites and see what got missed. I don't think there are larger lessons to draw from that occurrence. A reputation for security has to be earned, and Ghostty hasn't been around long enough for that. From my vantage point it's on track, but only time will tell.
- akerl_ 2y ago
  I'm not trying to knock either Ghostty in particular or new software in general. But the kind of "open season" phase you're referring to is basically the same point I'm making: new software still has to go through the phase where they work through their security model, have it probed by researchers, and earn their reputation.

woadwarrior01 2y ago

I did the same. Although, Ghostty doesn't seem to have support for Find (⌘-F), yet. Also, had some minor hiccups with it and tmux on remote hosts.

NovaX 2y ago
I've resorted to using Cmd-Shift-J (scrollback buffer) and grepping that, but its flaky about whether it will honor the command and emit a history file.

dave4420 2y ago

I tried Ghostty earlier in the week, but couldn’t get it set up to look the same as iterm2 (the colours are off and text looks different somehow with the same typeface at the same size). Which is just cosmetic but makes it feel wrong viscerally. I’ll give it another go at the weekend.

crabique 2y ago
Somehow this is the first time I see anyone else bring this up, but the fonts are absolutely displayed with wrong kerning on my mac, for my font (at 12pt) I was able to make it look the same as iTerm2 with adjust-cell-{width,height} both set to -5%.
- Hamuko 2y ago
  I had an issue where Ghostty failed to render the text "th", so I think Ghostty just generally has a lot of font issues. Gave up trying to use it within minutes.
samatman 2y ago
Ghostty supports iTerm themes, so you should be able to transfer your preferred look-and-feel directly. I just picked one I liked, so I'm not familiar with the process, but it can be done.
- d4rkp4ttern 2y ago
  Could you please point to the docs about how to transfer iTerm2 themes to Ghostty? I couldn't find it.
  - samatman 2y ago
    It looks like the process is more manual than I thought, sorry. There's something which imports themes from the iTerm2 color schemes website weekly, but from what I can find that isn't a feature which ships with Ghostty itself. Here's the relevant docs page, which I hope explains why I mistakenly thought that transferring a theme directly from iTerm to Ghostty was possible. You could upload your theme to the website they're being sourced from, and wait a week. But that's clearly not the same thing. https://ghostty.org/docs/features/theme https://ghostty.org/docs/features/theme

crabique 2y ago

Unfortunately, it's nowhere near close feature-wise just yet: proper quake mode, search, prompt navigation, line timestamps, tab output indicators, forced keyboard locales, customizable toolbar with user-defined variables/indicators, are all too useful to give up iTerm2 for anything.

lilyball 2y ago
What's not proper about Ghostty's quake mode?
- Aeolos 2y ago
  It does not support tabs, for one.
__float 2y ago
What is "proper Quake mode"? Have you tried https://ghostty.org/docs/config/keybind/reference#toggle_quick_terminal https://ghostty.org/docs/config/keybind/reference#toggle_qui...? (I don't have the habit to use this feature, but I'd like to!) The others do sound useful too -- I personally hit a lot of spurious "tab output indicator" notifications in iTerm2, but if it _did_ work I could see how giving it up would be painful.
- Geezus_42 2y ago
  I got the toggle working, but couldn't get background transparency.
- crabique 2y ago
  Proper quake mode is just one shortcut to show/hide the entire terminal window, otherwise the app is completely hidden from the app switcher and the dock. This also involves handling macOS keyboard-to-app layout mapper not reacting to this event as the window loses its first-class citizen status in this mode.
cosmic_cheese 2y ago
I tried iTerm’s quake mode after the Visor haxie for Terminal.app was shuttered, but unfortunately was left disappointed. Its behavior is kinda glitchy and inconsistent in comparison, which was surprising because one would expect a native feature to be better than one hacked in by a third party, but that was not the case here.

rcpt 2y ago

I tried Ctrl+r while she'd and it didn't work. Otherwise ghosty looked great

segasaturn 2y ago

I tried Ghostty but the configuration file seems to be flakey. For example I wasn't able to turn off the cursor blinking in it (huge distraction for me) despite there being a configuration flag for it, it just wouldn't take it.

auscompgeek 2y ago
There's a known issue where the shell integration doesn't respect that setting when it sets the cursor shape. https://github.com/ghostty-org/ghostty/discussions/2812 https://github.com/ghostty-org/ghostty/discussions/2812
dsego 2y ago
Have you tried shell-integration-features = no-cursor ?

kergonath 2y ago

I am using both at the moment, but iTerm has many, many features missing in ghostty. Most of them are not huge, but overall that’s a lot of paper cuts. Ultimately I wish both will stick around. Both have good ideas and I’d like them to keep evolving.

tylersmith 2y ago

Ghostty hasn't had to put out a critical update since before 1.0 launched.

throwaway314155 2y ago

> It's very familiar... It is? Because as far as I can tell it is deliberately quite different from iTerm2. No GUI for preferences, for instance. Not knocking it, it's a great terminal. I wouldn't describe it as "familiar" though, unless you're switching from, say, WezTerm or Alacritty.

FreePalestine1 2y ago

Does Ghostty support natural text editing like iTerm2 does?

dsego 2y ago

I also switched over to Ghostty, but now can't do Cmd+F to search for strings, I think it's on the roadmap though. Also, there are no scroll bars on the Mac version, which I guess is not that important for a terminal.